Re: [PATCH] ata: libata-scsi: bound the ATA passthru sense descriptor writes

[Damien Le Moal]

On 9/23/26 03:26, Matthias Goergens wrote:
> When an ATA PASS-THROUGH command to an ATAPI device fails, the sense
> buffer holds the device's REQUEST SENSE reply, and
> ata_scsi_set_passthru_sense_fields() trusts its additional length
> byte, sb[7], when adding the ATA Status Return descriptor.  A faulty
> or malicious device can use that to make the kernel read and write
> past the 96-byte buffer in three ways:
> 
> - scsi_sense_desc_find() is passed sb[7] + 8 as the buffer length, so
>   its clamp against sb[7] does nothing and the walk runs off the end.
> - A type-9 descriptor found near the end is filled in unchecked.
> - A new descriptor at sb[8 + len] needs len + 22 bytes, not len + 14,
>   so len 75..82 writes up to 8 bytes past the end.
> 
> Reproduced with KASAN under qemu, with the emulated ATAPI REQUEST SENSE
> reply patched:
> 
>   BUG: KASAN: slab-out-of-bounds in scsi_sense_desc_find+0x1a5/0x210
>   BUG: KASAN: slab-out-of-bounds in ata_scsi_qc_complete+0x1a15/0x1a50
> 
> Both are gone with this patch, and a valid descriptor is still filled
> in.
> 
> Fixes: 97981926224a ("ata: libata-scsi: Do not overwrite valid sense data when CK_COND=1")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Matthias Goergens <matthias.goergens@xxxxxxxxx>

Looks good.

Reviewed-by: Damien Le Moal <dlemoal@xxxxxxxxxx>

-- 
Damien Le Moal
Western Digital Research